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A DUAL, FAULT-TOLERANT AEROSPACE ACTUATOR 
Clete J. Slebert* 


ABSTRACT 

The requirements for mechanisms used In the Space Transportation System 
(STS) are to provide dual fault tolerance, and if the payload equipment 
violates the Shuttle bay door envelope, these deployment/restow mechanisms 
must have independent primary and backup features. This paper describes the 
research and development of an electromechanical actuator that meets these 
requirements and will be used on the Transfer Orbit Stage (TOS) program. 


INTRODUCTION 

This dep'coyment/restow mechanism will be used to perform three separate 
functions on the TOS program: 

o Provide power to latch and unlatch the upper half of the forward 

Airborne Support Equipment (ASE) cradle. 

o Provide power to open and close the upper half of the forward ASE 
cradle. 

o Tilt the TOS/ spacecraft (TOS/SC) combination for separation from the 
Siuttle and restow the aft ASE cradle for landing. 

The Shuttle/TOS on-orbit configuration is illustrated in Figure 1. 

REQUIREMENTS 

The requirements imposed on the actuator mechanism to perform the 
required functions are summarised as follows: 

Safety Requirements (in aooordance with NHB 1700. 7A) 

o Independent primary and backup actuator functions are mandatory. 

o Combination of primary and backup methods must be two-failure 
tolerant. 
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Operational Requirements 


o Provide power to latoh and unlatch the forward cradle halves. 

o Provide power to open and close the upper half of the forward cradle 

112 ° + 5 *. 

o Ereot the TOS/SC combination 45* +5° for separation. 

o Provide erection capability under active Vernier Reaction Control 

System (VRCS) or free-dri ft conditions the Primary Reaction Control 
System, (PRCS) and Crblter Maneuvering System (OMS) are inhibited 
during rotation. 

o Provide capability to react VRCS and PRCS when TOS/SC is in the 

erected position. 

o Provide multiple erecticn/restow oycle capability for each mission; 
restow capability for an abortive mission is mandatory. 

o Provide performance for 80 orbiter missions over 10 years. 

System Reoulrmsnts 

o Unlatch or latch forward cradle in less than 4 minutes. 

o Raise or ^.owar forward cradle half 112 s in less than 2 minutes. 

o Erect or restow TOS/SC 45* in less than 2 minutes. 

o Withstand all deploymant and landing loads (each actuator). These 
loads to be reaoted througi the aotuator structure and lock gears. 

o Not to exoeed 310 N (70 lb) per actuator. 

o Operate at temparatures from -28*C to +59*C (-15 *P to ♦140*F). 

o Provide redundant limit switohes, solenoids, DC power and avionics. 

o Provide (one motor/clutoh combination) sufficient torque under 

worst-case conditions to perform required function. 

o Provide force margins of 100} at worat-nase conditions for all 

aotuators. 



CONCEPT DEVELOPMENT 


During the design trade-off phase, several priorities were established as 
design goals. These were 

o Satisfy all safety requirements of NHB 1700-7A without any waiver 
requests. 

o Use minimal design complexity and manufacturing simplicity. 

o Use previously qualified space hardware and components. 

o Provide a common design capable of a broad range of torque output 

forces with minimal configuration changes. 

o Combine additional mechanism functions within the actuator to 

eliminate additional separate mechanisms* 

HARDWARE CONFIGURATION 

Each actuator, as illustrated in Figure 2 consists of the following major 
components: 

o Structural housing containing the ball screw and nut assembly, 

reduction gear train, and attachment clevis ends. 

o Redundant DC gearhead motors. 

o Redundant DC solenoid-type, positive-engagement clutches. 

o Spring-loaded drlve-engagoment pin and pyrotechnic disengage. 

o Redundant position-indication potentiometers. 

o Redundant solenoid-powered lock gears. 

o Redundant microswitches for lock-gear and actuator-engagement-pin 

indication. 


ACTUATOR FEATURES 

Most actuator systems presently being used on the STS are physically 
separated from the structure in the event of primary actuator failure, thus 
allowing the backup actuator to be used. These systems require separate 
swingaway, catch, and latch mechanisms. The Martin Marietta actuator is 

self-oontained in the evsnt of primary actuator disengagement. This is 
possible since the actuator selector drive pin with its pyro release is 
contained within the actuator. The disengaged primary actuator simply 
becomes a free-sliding, telescoping tube assembly. 
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Additionally, the actuator has been designed to withstand the crbiter 
launch and landing loads, the TO S/SC deployment loads, and the orbiter 
maneuvering loads. This design feature eliminated the requirement for a 
separate landing lock mechanism and a deployment lock mechanism. 

Rate control is normally used with actuators to control the output speed 
and prevent excessive slow rates to the payload being raised for deployment. 
This closed-loop, complex electronic control is required on rotar 7 actuator 
systems and some existing screw-drive systems to prevent a possible runaway 
condition. 

In the Martin Marietta actuator, this rate controller can be eliminated 
because drive motor gearhead reduction limits th< maximum RPM. Maximum screw 
extension/retraction rates cannot exceed the free running speed of the drive 
motor as reduced through the reduction gear train and drive nut. 

The maximum impact force when erecting the TOS/SC is less than 33-9 N-m 
(25 lb ft.). This low impact force allows the use of a simple structural 
hard stop, rather than a viscous damper. 

The actuator motor shutoff is accomplished by use of a redundant motor 
current limiting circuit. The structure being deployed, or stowed, contacts 
a structural hard stop, thus increasing motor current demand, and motor 
shutoff occurs. 

This method allows the required 100$ force margin at worst-case 
conditions, while preventing structural overloads under best-case 

conditions. Additionally, the clutch assembly can be adjusted to slip at a 
predetermined torque, also preventing an accidental overload condition. 
Position indication to the crew is accomplished by the use of redundant 
rotary potentiometers that provide actuator extension/retraction data. 

Since the actuator mechanism is a back-driveable device, a locking 
mechanism must be incorporated. A redundant, solenoid-operated, dual-gear, 
mesh lock has been selected for this design. A similar design has previously 
been used on the Inertial Upper Stage (IUS) program. 

DISCUSSION 

This actuator mechanism moots all the STS safety requirements as defined 
in NHB 1700. 7A, and also meets the structural, life, and T05 mission 
requirements for the following reasons: 

o The orbiter crew can use the Standard Switch Panel (SSP) at any 
point in the actuation cycle to stop, restart, and disengage the 
primary actuator, and engage the backup actuator. This allows for 
complete restow of the TOS/SC in case of a mission abort. 

o Force margins are at least 100$ greater than the required torques at 
worst-case conditions (Figures 3A, 6 anu C) . 
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o Each pair of actuators, primary and backup, has triple electrical 

redundancy and complete mechanical redundancy c 

o All rolling-element bearings are sized to exceed the L10 life by a 
minimum factor of 17* 

o Each actuator is capable of greater than 1000 duty cycles during its 
operating life, which far exceeds the 80 mission requirement* 

o Clutches are designed for positive power-off disengagement using 

redundant, captive compression springs. 

o The structural ultimate factor of safety is 1.4 minimum. Gear 

stress levels are less than one-fourth of the material ultimate 
stresses. 

o Lubrication is a combination of wet and dry lubricants. All sliding 
surfaces are treated with space-qualified dry lubricants; however, 
they are designed to function without lubrication. All bearings, 
gears, and ball screw are lubricated with Bray Oil 3L-38RP, a 
qualified vacuum-stable grease. 

o The static load capability of the actuator is 8000 lb. 

o The actuator design can be easily modified to meet a variety of 

force and extension/retraction rate requirements (Table 1). 

CONCLUSION 

The actuator design selected for use on the T0S program meets the 

requirements for STS safety requirements. This design has successfully 
passed the NASA Phase I Safety Review without receiving any mechanical Review 
Item Discrepancies, nor were any safety waivers required. The design studies 
and tradeoff analysis resulted in a multifunction, simple mechanism that is 
easily adaptable to various output torque requirements ana 

extension/retraction cycle times. 
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SHUTTLE/TOS CONFIGURATION 


ORIGINAL RAGE IS 
OF POOR QUALITY 
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FIGURE 1 



ELECTROMECHANICAL DRIVE ACTUATOR 
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FIGURE 2 






LATCH ACTUATOR TORQUE MARGINS 
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UPPER FORWARD CRADLE HINGE TORQUE MARGINS 
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ARM ANGLE FROM LATCHED POSITION 



TILT ACTUATOR TORQUE MARGINS 



AF1 CRADLE ARM ANGLE FROM STOWED POSITION 


TABLE 1 
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